Bank Data Sharing — Requirements v2.115 min read

If the authenticated customer does not hold any accounts matching the requested consent parameters (e.g. AccountType, AccountSubType, or the permissions requested), the consent will be set to Rejected with error: invalid_request and error_description: user_lacks_eligible_accounts.

Must contain a valid Bearer access token issued with the accounts openid scope. The consent bound to the token must be in Authorized status and the ExpirationDateTime of the Consent must be in the future.

The version in the request URL path must match the version in the consent's authorization_details[0].type.

The consent must include ReadAccountsBasic or ReadAccountsDetail.

Must be a valid account ID shared by the customer — i.e. returned by GET /accounts under the same consent. See Account Access Validation for the response when the customer does not hold the account.

Should be included. Should be a valid UUID (RFC 4122). An invalid value will not cause a failure but tracing will not be possible.

Must be sent when the customer is authenticated at the time of the call. Must be a valid HTTP-date (RFC 7231).

Must be sent when the customer is actively present at the time of the call. Must be a valid IPv4 or IPv6 address.

Should be sent when the customer is actively present. Should reflect the user-agent of the customer's browser or device.

Supported for all account subtypes: CurrentAccount, Savings, CreditCard, Finance, Mortgage.

Must contain a valid Bearer access token bound to an Authorized consent.

Must match the consent version.

The consent must include ReadBeneficiariesBasic or ReadBeneficiariesDetail.

Must be a valid account ID shared by the customer — i.e. returned by GET /accounts under the same consent. See Account Access Validation for the response when the customer does not hold the account.

Should be a valid UUID (RFC 4122).

Must be sent when the customer is authenticated at the time of the call.

Must be sent when the customer is actively present at the time of the call.

Should be sent when the customer is actively present.

Only supported for CurrentAccount and Savings accounts. Not available for CreditCard, Finance, or Mortgage accounts.

Must contain a valid Bearer access token bound to an Authorized consent.

Must match the consent version.

The consent must include ReadProduct. ReadProductFinanceRates is required for finance rate data to be included in the response, and is only available to TPPs holding the Access Encrypted Resource Data certification — see Consent Creation.

Must be a valid account ID shared by the customer — i.e. returned by GET /accounts under the same consent. See Account Access Validation for the response when the customer does not hold the account.

When the consent includes ReadProductFinanceRates, the TPP MUST only call this endpoint from an active customer-facing session — the customer must be using the TPP application at the time of the call. Background or scheduled calls are not permitted on a consent that carries ReadProductFinanceRates, because the encrypted-rate flow requires the customer to receive and enter the one-time code in real time. Consequently x-fapi-customer-ip-address and x-fapi-auth-date MUST be set on every such call.

Should be a valid UUID (RFC 4122).

Must be sent when the customer is authenticated at the time of the call. MUST be sent on every call when the consent carries ReadProductFinanceRates, because such calls are always customer-present.

Must be sent when the customer is actively present at the time of the call. MUST be sent on every call when the consent carries ReadProductFinanceRates, because such calls are always customer-present.

Should be sent when the customer is actively present.

Supported for all account subtypes.

If FinanceRates is returned as a JWE, the TPP must prompt the User to enter the encryption key delivered to them by the LFI (e.g. via SMS or push notification) before decryption can proceed.

Decryption of the JWE must be performed locally on the User's device. The decrypted data must not be transmitted to the TPP's servers or persisted in any storage accessible to the TPP's application.

The decrypted data must only be used to display the rates to the User within the active session. The TPP must not store, transmit, or otherwise process the unencrypted data.

The TPP must observe the exp value in the JWE header and discard any decrypted data once the expiry threshold has passed. If the data is still required, the TPP must repeat the API operation to retrieve a fresh response — the original consent must still be valid for this to succeed.

The TPP must discard all decrypted data from memory when the User closes their session, regardless of whether exp has been reached.

Must contain a valid Bearer access token bound to an Authorized consent.

Must match the consent version.

The consent must include ReadStandingOrdersBasic or ReadStandingOrdersDetail.

Must be a valid account ID shared by the customer — i.e. returned by GET /accounts under the same consent. See Account Access Validation for the response when the customer does not hold the account.

Should be a valid UUID (RFC 4122).

Must be sent when the customer is authenticated at the time of the call.

Must be sent when the customer is actively present at the time of the call.

Should be sent when the customer is actively present.

Only supported for CurrentAccount and Savings accounts.

Must contain a valid Bearer access token bound to an Authorized consent.

Must match the consent version.

The consent must include ReadStatements.

Must be a valid account ID shared by the customer — i.e. returned by GET /accounts under the same consent. See Account Access Validation for the response when the customer does not hold the account.

If provided, must be a valid ISO 8601 date and must not be after toStatementDate. A contradictory range is rejected with 400 Resource.InvalidFormat. Filtering is open-ended if not provided.

If provided, must be a valid ISO 8601 date and must not be in the future. A future toStatementDate is rejected with 400 Resource.InvalidFormat. Filtering is open-ended if not provided.

Should be a valid UUID (RFC 4122).

Must be sent when the customer is authenticated at the time of the call.

Must be sent when the customer is actively present at the time of the call.

Should be sent when the customer is actively present.

Supported for all account subtypes.

Must contain a valid Bearer access token bound to an Authorized consent.

Must match the consent version.

The consent must include ReadParty, ReadPartyUser, or ReadPartyUserIdentity.

Should be a valid UUID (RFC 4122).

Must be sent when the customer is authenticated at the time of the call.

Must be sent when the customer is actively present at the time of the call.

Should be sent when the customer is actively present.

Supported for all account subtypes.